Cannot create tag with RBAC rol "Tag Contributor" on a storage account

Question

I have a storage account where I have the following RBAC roles: Reader and Tag Contributor

However if I try to add a tag through the portal this is not possible and I am getting the following error (anonymised the resource IDs):

The client 'me@ssss .nl' with object id 'some guid' does not have authorization to perform action 'Microsoft.Storage/storageAccounts/write' over scope '/subscriptions/<subscription id>/resourceGroups/<resource group name>/providers/Microsoft.Storage/storageAccounts/<storage account name>' or the scope is invalid. If access was recently granted, please refresh your credentials.

Looks like the scope is not correct or the portal is using some different API (the "storages account update" instead of the "tag update" I assume) I was expecting the "Microsoft.Resources/tags/*" scope here.

Any advice on how this should work with only these RBAC roles.

Kind regards,
Rik Ribbers

Answer 1

@Anonymous

Currently, the tag contributor role can't apply tags to resources or resource groups through the portal. It can apply tags to subscriptions through the portal. It supports all tag operations through PowerShell and REST API. More information on this can be found on this page.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Ok, Thanks for the feedback!